The Problem of Double Punishment in the Enforcement of Criminal and Administrative Penalties under the Personal Data Protection Act B.E. 2562

Abstract

This research consists purposes were 1. to study the principles, concepts and theories related to the imposition of criminal penalties, administrative fines and the principle of criminal law as a measure of last resort in personal data protection law 2. to study the provisions of the Personal Data Protection Act B.E. 2562 (2019) that establish criminal liability and administrative fines and to analyze the problem of imposing dual penalties in cases where a single act may be punished repeatedly under multiple statuses 3. to comparatively study the imposition of penalties under Thailand's personal data protection law and the laws of the European Union, Germany, Spain, the People's Republic of China and Australia, in order to analyze appropriate approaches to the use of criminal and administrative penalties and 4) to propose guidelines for amending the Personal Data Protection Act B.E. 2562 (2019) to align with the principle of proportionality, the principle of prohibition against double punishment and international guidelines on personal data protection. This is qualitative research using documentary research, such as books, textbooks, academic articles, research studies and legal documents, both domestic and international, with the collected data then analyzed through content analysis. The findings revealed that 1) the principle of criminal law as a measure of last resort (Ultima Ratio), the principle of proportionality and the principle of prohibition against double punishment (Ne bis in idem) are fundamental principles that should be applied in determining sanctions under personal data protection laws, as such laws primarily function as administrative regulatory legislation 2) certain provisions of the Personal Data Protection Act B.E. 2562 (2019), particularly Sections 79 and 84, contain partially overlapping elements of liability, resulting in a single act potentially giving rise to both criminal and administrative liability, which may lead to the problem of double punishment 3) The personal data protection laws of the European Union, Germany, Spain, the People's Republic of China and Australia all primarily rely on administrative measures as the main mechanism for law enforcement and 4) The relationship between criminal penalties and administrative fines should be clearly defined to prevent double punishment for the same act, with administrative measures being used as the main enforcement mechanism and criminal penalties limited to cases that are serious in nature or involve fraudulent intent.